Privacy Policy

This Privacy Policy explains how Composite Athlete, a brand owned and operated by Harvey Brands LLC(“we,” “us,” or “our”) collects, uses, shares, and protects information when you use our website, applications, and services (the “Platform”). By using the Platform you agree to this Policy. It should be read alongside our Terms & Conditions.

1. Information we collect

• Account information — your name, email address, and a securely hashed password.
• Health & fitness information you provide — onboarding and check-in responses (goals, training history, a pre-participation health screen, injury/pain reports), body measurements, heart-rate zones, and your logged training and nutrition. This is sensitive information (see Section 3).
• Media you upload — progress photos, form-check videos, and any medical-clearance documents you choose to share.
• Messages — communications you send to a coach or to us through the Platform.
• Payment information — subscriptions are processed by Stripe. We do not collect or store your full card number; Stripe handles card data and shares only limited billing status with us.
• Usage & technical data — information such as IP address, device/browser, and activity on the Platform, used to operate and secure the service.
• Website analytics — we measure site traffic with a self-hosted, privacy-focused analytics tool (Umami) running on our own servers. It sets no cookies, collects aggregated and anonymized page/interaction data only, does not identify individual visitors, and shares nothing with third parties.

2. How we use your information

• To provide the Platform — generate and adapt your training and nutrition programs, deliver sessions, and enable coach–athlete coaching.
• To connect athletes and coaches you have chosen to work with, subject to your consent (see Section 4).
• To operate safety features — for example, surfacing a pain or health flag to your coach and prompting you to seek professional care.
• To process payments and manage subscriptions (via Stripe).
• To communicate with you — account, session, and support emails.
• To secure, maintain, and improve the Platform and to comply with legal obligations.

3. Health & fitness data

The health and fitness information you provide is used to personalize your programming and to power conservative safety responses. It is not medical advice, diagnosis, or treatment (see our Terms). We restrict access to this data (Section 6), and coaches can see it only within the scope you consent to.

4. How we share information

• With coaches — only after you request and consent to a coaching connection, and only within the sharing scope you set. You can revoke access, which ends the coach’s ability to see your data going forward.
• With service providers that operate the Platform on our behalf: Stripe (payments), Mailgun (transactional email), an AI/LLM provider (to generate programming and draft coach feedback — see Section 5), and our hosting provider (Hetzner). These providers process data only to provide their service to us.
• For legal reasons — to comply with law, enforce our Terms, or protect the rights, safety, and property of our users or the Company.
• We do not sell your personal information.

5. AI processing

We use a third-party large-language-model provider to generate training programs and draft coach feedback. To do this, relevant program inputs (for example, your sport, goals, and constraints) are sent to that provider’s API for processing. We do not use your data to train our own models, and we do not authorize the provider to train on it. AI-generated programming is educational and is not a substitute for professional medical or nutritional advice.

6. Data security

We host on a dedicated, firewalled server with a self-hosted database that enforces row-level securityand least-privilege access, so each account’s data is isolated at the database layer. Traffic is served over TLS/HTTPS, and backups are encrypted and stored off-site. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

7. Data retention

We retain your information for as long as your account is active and as needed to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated personal data (see Section 8); some records may be retained where the law requires.

8. Your rights and choices

• Access, correct, or update much of your information from your account.
• Revoke a coaching connection to stop future sharing of your data with that coach.
• Request a copy or deletion of your personal data by contacting us (Section 11). Depending on where you live, you may have additional rights under applicable privacy laws.

9. Children’s privacy

The Platform is intended for adults. You must be at least 18 to create an account; individuals under 18 may use the Platform only with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal information from children under 13.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Effective Date” above. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

11. Contact us

Questions about this Policy or your data? Email support@compositeathlete.com or write to us at 2425 Grand Pine Ln, Clemmons, NC 27012.